elastic / elastic/detection-rules

[New Rule] AWS security agent detection

Open
#6,155 0 comments 0 reactions 1 assignee Assigned to @bryans3c View on GitHub
community Rule: New Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Description

Hello, I'd like to propose a detection that buils on this https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html#can-i-protect-my-website-from-being-pentested-by-ai-agents

Image

The detection as suggested in based on the user agent `securityagent` and it could target WAF logs but also webserver logs.

`user_agent.original : "*securityagent*"`

### Target Ruleset

None

### Target Rule Type

None

### Tested ECS Version

_No response_

### Query

_No response_

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html#can-i-protect-my-website-from-being-pentested-by-ai-agents

### Redacted Example Data

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.